Skip to content

validate.js Regular Expression Denial of Service vulnerability #21171

@sanya-jolly

Description

@sanya-jolly

Is there an existing issue for this?

  • I have searched the existing issues

Appium Version

2.17.1

Appium Host Type

Command Line

Are you using Appium components not maintained by the Appium team?

No response

Is this issue reproducible using the latest components?

  • I confirm the issue is still reproducible with the latest component versions

Current Behavior

Image
Image
Image

Expected Behavior

Regular expressions are patterns used to match character combinations in strings. Certain poorly constructed patterns can lead to excessive backtracking, especially when processing crafted malicious inputs. This excessive backtracking can cause the application to hang or crash, resulting in a denial of service.

Thus, patch should be available for this.

Appium Log

No response

Environment Details

  • Debug details (appium --show-debug-info):
  • Last component version(s) which did not exhibit the problem:
  • Platform and version of device under test:
  • Real device or emulator/simulator:

Minimal Reproducible Example

just run yarn audit on RN .77 in any mobile project

Further Information

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    Dependenciesissues with dependenciesNodeNode.js-specific issuev3Appium v3

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions